multikv

Description

Extracts field-values from table-formatted events, such as the results of top, netstat, ps, and so on. The multikv command creates a new event for each table row and assigns field names from the title row of the table.

The first line of text provides the names for the data in the columns.

multikv can transform this table from one event into three events with the relevant fields. It works more easily with the fixed-alignment though can sometimes handle merely ordered fields.

The general strategy is to identify a header, offsets, and field counts, and then determine which components of subsequent lines should be included into those field names. Multiple tables in a single event can be handled (if multitable=true), but may require ensuring that the secondary tables have capitalized or ALLCAPS names in a header row.

Auto-detection of header rows favors rows that are text, and are ALLCAPS or Capitalized.

If you have Splunk Cloud and want to use this feature, file a Support ticket specifying the multi-key-value extractions you want to define.

Syntax

multikv [conf=<stanza_name>] [<multikv-option>...]

Optional arguments

conf

Syntax: conf=<stanza_name>

Description: If you have a field extraction defined in multikv.conf, use this argument to reference the stanza in your search. For more information, refer to the configuration file reference for multikv.conf in the Admin Manual.

Descriptions for multikv options

copyattrs

Syntax: copyattrs=<bool>

Description: When true, multikv copies all fields from the original event to the events generated from that event. When false, no fields are copied from the original event. This means that the events will have no _time field and the UI will not know how to display them.

Default: true

fields

Syntax: fields <field-list>

Description: Limit the fields set by the multikv extraction to this list. Ignores any fields in the table which are not on this list.

filter

Syntax: filter <term-list>

Description: If specified, multikv skips over table rows that do not contain at least one of the strings in the filter list. Quoted expressions are permitted, such as "multiple words" or "trailing_space ".

forceheader

Syntax: forceheader=<int>

Description: Forces the use of the given line number (1 based) as the table's header. Does not include empty lines in the count.

Default: The multikv command attempts to determine the header line automatically.

multitable

Syntax: multitable=<bool>

Description: Controls whether or not there can be multiple tables in a single _raw in the original events.

Default: true

noheader

Syntax: noheader=<bool>

Description: Handle a table without header row identification. The size of the table will be inferred from the first row, and fields will be named Column_1, Column_2, ... noheader=true implies multitable=false.

Default: false

rmorig

Syntax: rmorig=<bool>

Description: When true, the original events will not be included in the output results. When false, the original events are retained in the output results, with each original emitted after the batch of generated results from that original.

Default: true

Usage

The multikv command is a distributable streaming command. See Command types.

Examples

Example 1: Extract the "COMMAND" field when it occurs in rows that contain "splunkd".

multikv

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »